Netcore NBR200V2 v1.3.241127.071246 hit by CRITICAL OS command injection (CVE-2026-101002). Exploit code public, no patch. Isolate affected devices & apply network-level controls. https://radar.offseq.com/threat/cve-2026-101002-os-command-injection-in-netcore-nbr200v2-8a15ef317ba62749 #OffSeq #Ne...

TOTOLINK N150RT v3.4.0-B20201030 faces CRITICAL OS command injection (CVE-2026-100896, CVSS 9.4) ⚠️. Public exploit exists — restrict mgmt interface & check for updates. No patch yet. https://radar.offseq.com/threat/cve-2026-100896-os-command-injection-in-totolink-n150rt-29dd6473e6a24e03 #OffSeq ...

Seetong T8108 series faces CRITICAL CVE-2026-100886: remote unauthenticated access possible due to improper authentication (v4.6.1.4). No patch — restrict device access immediately. https://radar.offseq.com/threat/cve-2026-100886-improper-authentication-in-seetong-t8108-acea634abd75f700 #OffSeq #...

CRITICAL: requests-cache-utils v1.0.0 (PyPI) contains install-time malware, exfiltrating browser data. Remove and avoid use. Full details: https://radar.offseq.com/threat/malicious-code-in-requests-cache-utils-pypi-e8c3f4806b2131ca #OffSeq #Malware #PyPISecurity

donutautosellsrc PyPI package (v0.3.7 – 0.3.9) is CRITICAL: contains obfuscated infostealer using blockchain C2. Uninstall affected versions now and monitor for data loss. https://radar.offseq.com/threat/malicious-code-in-donutautosellsrc-pypi-adf2fee072c2c5b1 #OffSeq #PyPISecurity #Malware

Ad Inserter plugin (WP, 2.8.12 – 2.8.18) hit by CRITICAL code injection. Subscriber users can run PHP or serve XSS. Upgrade to 2.8.19+ now. https://radar.offseq.com/threat/cve-2026-81655-cwe-94-improper-control-of-generation-of-code-code-injection-in-ad-inserter-d330f89b1f759aca #OffSeq #WordPres...

CRITICAL: Contrast <1.16.0 vulnerable to attestation relay attacks. Unbound TEE reports can let attackers impersonate trusted workloads. Patch now. https://radar.offseq.com/threat/contrast-before-1160-is-susceptible-to-remote-attestation-relay-attacks-cve-2026-100835-3833ee713219f7e3 #OffSeq #CVE...

D-Link DIR-895L faces CRITICAL CVE-2026-100740 (CVSS 9.4): out-of-bounds write enables remote attacks. Exploit code is public. No patch yet — monitor vendor for updates. https://radar.offseq.com/threat/cve-2026-100740-out-of-bounds-write-in-d-link-dir-895l-73af9e0aee6421f0 #OffSeq #CVE2026100740 ...

OpenClaw Slack (<2026.8.1) faces HIGH severity (CVSS 8.7) auth bypass in multi-person DMs — unauthorized users can trigger Slack agents. Upgrade to 2026.8.1+ to secure your data. https://radar.offseq.com/threat/cve-2026-100575-missing-authorization-in-openclaw-slack-2a3447a3c9192e9f #OffSeq #Vuln...

openclaw msteams <2026.8.1 has a HIGH severity bug (CVE-2026-100582) allowing unauthorized channel reads. Upgrade to 2026.8.1+ to block data exposure. https://radar.offseq.com/threat/cve-2026-100582-missing-authorization-in-openclaw-msteams-98e504ab6e11afa6 #OffSeq #Vulnerability #Cybersecurity

CRITICAL: tobychui zoraxy 3.2.3 – 3.3.4 has auth bypass (CVE-2026-100390) via IPv6 X-Forwarded-For spoofing. Restrict IPv6 or avoid IP-based controls until patched. https://radar.offseq.com/threat/cve-2026-100390-authentication-bypass-by-spoofing-in-tobychui-zoraxy-92a9e1620a0f6d01 #OffSeq #CVE20...

chromatitle npm v1.0.0 carries CRITICAL malicious code: obfuscated loader fetches & runs remote payloads on import. Remove & audit dependencies ASAP. No patch available. #OffSeq #npm #Security https://radar.offseq.com/threat/malicious-code-in-chromatitle-npm-1cefd95c647d92b5

CRITICAL: Bitget hit by $351.6M theft from hot/warm wallets — multiple blockchains affected. Withdrawals paused, User Protection Fund covers losses. Monitor for updates. https://radar.offseq.com/threat/hackers-steal-3516-million-in-bitget-crypto-exchange-hack-95a2b6dc1669868f #OffSeq #cryptosec #...

CRITICAL: n8n-nodes-moonlet-helpers (npm, v1.0.0/1.0.4) installs attacker code via postinstall script. Remove package, scan for /tmp/.np, and avoid affected versions. https://radar.offseq.com/threat/malicious-code-in-n8n-nodes-moonlet-helpers-npm-12fed58075d25a88 #OffSeq #npm #Security

Eufy Omni C20 (<1.6.4) has a CRITICAL cert validation flaw (CVE-2026-93291). MITM risk & code execution possible. Patch status unconfirmed — review vendor updates. 🔐 https://radar.offseq.com/threat/cve-2026-93291-cwe-295-improper-certificate-validation-in-eufy-omni-c20-63bb60225f0bad8d #OffSeq #I...

CRITICAL: Isolation failure in Atlassian Rovo lets attackers access & run code in other user/tenant sessions. No patch yet — pause sensitive use, monitor vendor updates. https://radar.offseq.com/threat/critical-cross-user-and-cross-tenant-compromise-in-atlassian-rovo-d49ff9569505cde6 #OffSeq #Atl...

Deltaww DIAEnergie (pre-1.11.00.022) hit by CRITICAL Improper Authentication flaw — auth bypass possible. Patch ASAP when available. https://radar.offseq.com/threat/cve-2026-78308-cwe-287-improper-authentication-in-deltaww-diaenergie-6cc9f25ab57e2374 #OffSeq #ICS #Vulnerability

Malicious npm package '[email protected]' (CRITICAL) enables arbitrary code execution. Remove immediately, check for typosquatting, and verify dependencies. https://radar.offseq.com/threat/malicious-code-in-pino-testkit-npm-da4f2d1960e5a45d #OffSeq #npm #SupplyChain

IBM Concert (v1.0.0 – 3.0.0) is affected by a CRITICAL use-after-free vulnerability (CVSS 9.8). Remote exploitation possible — patch status unconfirmed. Monitor IBM advisories: https://radar.offseq.com/threat/cve-2026-6928-cwe-416-use-after-free-in-ibm-concert-2eb5c8a4bd6982d7 #OffSeq #IBM #CVE20...

CVE-2026-93352 in plank laravel-mediable (<7.0.2): CRITICAL risk of RCE via .pht file uploads. Update to 7.0.2+ to patch. https://radar.offseq.com/threat/cve-2026-93352-unrestricted-upload-of-file-with-dangerous-type-in-plank-laravel-mediable-969ae75c94489a3a #OffSeq #CVE202693352 #RCE